Most businesses do not have a document problem. They have a decision problem.
Nobody wants to be the person who shreds a file and then needs it eight months later during an audit. So the safe-feeling choice is to keep everything. Boxes go to the storage room, the storage room fills up, and eventually a decade of customer records, payroll files and tax paperwork is sitting in a corner that anyone with a hand truck could walk out with.
Keeping everything forever is not the cautious option. It is its own kind of risk. Here is a practical look at how long records typically need to be held, and what to do the day that clock runs out.
Every file you keep past its useful life is a file you are responsible for protecting.
That responsibility is real. Under FACTA, businesses are required to properly dispose of consumer information rather than simply discarding it. HIPAA carries similar obligations for medical, dental and insurance offices handling patient information. The Red Flags Rule adds another layer for organizations extending credit. None of those rules care whether a document was old, forgotten, or in a box you meant to deal with last spring.
There are practical costs too:
A clear retention schedule solves all four at once.
Retention requirements vary by document type, industry and situation. The ranges below reflect commonly used guidelines and are a good starting point for building your own policy.
| Record Type | Typical Retention Period |
|---|---|
| General tax returns and supporting documents | 3 to 7 years |
| Employment tax records | At least 4 years |
| Payroll records and time cards | 3 to 7 years |
| Accounts payable and receivable ledgers | 7 years |
| Bank statements and cancelled checks | 7 years |
| Expense reports and receipts | 3 to 7 years |
| Employee personnel files (after termination) | 7 years |
| Job applications from non-hired candidates | 1 to 3 years |
| Expired insurance policies | 3 to 7 years |
| Expired contracts and leases | 7 years after expiration |
| Patient records (HIPAA-covered practices) | Varies; often 6 to 10 years or longer |
Keep permanently: articles of incorporation, corporate bylaws, business licenses, deeds and property records, trademark and patent filings, audit reports, annual financial statements, board meeting minutes, and pension or retirement plan documents.
Two important notes. First, retention periods are usually measured from the date a document was filed or a matter closed, not the date it was created. Second, these are general guidelines. Your accountant or attorney should sign off on the final schedule, particularly if you operate in healthcare, financial services, or any regulated industry with its own rules.
After more than four decades serving businesses across Ohio, a few patterns come up again and again.
No written policy. If retention lives in one person’s head, it disappears when that person does. A one-page written schedule is enough to start.
“We’ll sort it later.” Boxes marked for review sit untouched for years. The sorting never happens because it is nobody’s specific job. Assign it, or schedule it.
Digital-only thinking. Businesses invest heavily in firewalls and password policies while paper records sit in an unlocked room. Attackers are opportunistic, and a filing cabinet requires no technical skill at all.
Relying on the office shredder. A small cross-cut shredder handles a stack, not a storage room. Facing hundreds of pounds of paper, most teams give up and the boxes stay put.
Forgetting hardware. Retired computers, external drives, backup tapes and copier hard drives all store recoverable data. Deleting files and reformatting a drive does not remove that data reliably, which is why physical hard drive destruction is the only way to be certain.
Once a document has passed its retention window and is not subject to a legal hold, it should be destroyed securely and documented.
The simplest approach for most businesses is a two-part system:
1. Handle the backlog with a one-time purge. If you have years of accumulated files, a one-time purge shredding service clears the whole thing in a single visit. No contract, no long-term commitment. You get your storage room back and you eliminate the material you were never required to keep.
2. Prevent the next backlog with scheduled service. Locked security containers are placed throughout your office, staff deposit sensitive material as part of their normal routine, and scheduled shredding visits happen on a set interval. Nothing accumulates because destruction is built into the workflow instead of postponed.
With mobile shredding, destruction happens in a self-contained truck at your location, so you can watch it happen. A Certificate of Destruction is issued afterward, which is the documentation you want on file if a regulator or auditor ever asks how a specific record was disposed of.
Everything shredded is recycled, so clearing out that storage room does something good on the way out the door.
You do not need a compliance department to do this well.
How long should a small business keep tax records? Three to seven years is the common range, with seven years being the safer default for most businesses. Confirm the right period with your accountant based on your filing history.
Can I just throw old business records in the recycling bin? No. Documents containing customer, employee or financial information must be disposed of in a way that makes the information unreadable. Placing them in an open recycling bin can create legal exposure under FACTA and similar regulations.
What if a document is part of an ongoing legal matter? Retention schedules are suspended by a legal hold. Anything relevant to pending or anticipated litigation must be preserved regardless of its normal retention period. Speak with your attorney before destroying anything connected to an active matter.
Do I need a Certificate of Destruction? It is strongly recommended. The certificate is your proof that records were destroyed properly, which matters during audits, compliance reviews and investigations.
Sanmandy Document Destruction has been protecting Ohio businesses and families since 1983. We are locally owned, family operated, fully licensed, bonded and insured, and compliant with HIPAA, FACTA and the Red Flags Rule. We serve Wooster, Ashland, Canton, Mansfield, Medina, Wadsworth and the surrounding communities.
Whether you have a storage room to empty or you want ongoing service so it never fills up again, we can help.
Call (330) 435-4455 for a free quote, or contact us online to schedule your service.
